Time series anomaly detection (TSAD) is critical in various real-world applications. Due to the high cost of manual annotation, unsupervised methods are commonly employed to distinguish abnormal patterns from normal ones based on data or representation characteristics. However, the limited coverage of a single dataset often leads to misclassifying test-time normal patterns that deviate from the training distribution as anomalies. In view of this, we propose to introduce domain knowledge from auxiliary datasets (AuxSets) to enhance domain-level normality understanding in the target dataset (TargetSet). However, through in-depth analysis on the representation space of the TargetSet after incorporating AuxSets, we find that consistent knowledge about normality from homogeneous AuxSets do little help to TargetSet, while diverse knowledge from heterogeneous AuxSets can bring semantic confusion of normality for TargetSet, both of which can degrade TargetSet detection performance. To address the issue, we design DoKnowAD, a framework that introduces a Representation HyperVolume Estimation metric to identify helpful heterogeneous AuxSets, and further adopts contrastive learning to enforce loose coupling between datasets and high cohesion within single dataset to calibrate the TargetSet’s representation space, thus mitigating knowledge confusion. Extensive experiments on five popular datasets across different domains demonstrate that DoKnowAD consistently outperforms existing TSAD baselines in various metrics.

With the rapid development of digital technologies, a large range of real-world systems, spanning from cloud servers, IoT devices, to industrial control systems, continuously generate vast amounts of time series data. Time series anomaly detection (AD) plays a crucial role in maintaining system stability by identifying unusual patterns from normal distributions, with the primary challenge lies in learning effective anomaly-discriminative representations. Recently, diffusion models have been applied to time series AD due to their strong representational capabilities. However, existing diffusion-based methods typically rely on reconstruction errors, which not only fail to fully exploit the representational potential of diffusion models but also be computationally intensive. To address these limitations, through experimental observation and theoretical analysis, we show thatspecific regions of the diffusion noises exhibit stronger representation capabilitiesfor normal patterns, which can be leveraged to enhance AD performance and reduce computational costs. Building on these insights, we propose NoiseAD, a diffusion noise-guided anomaly detection method incorporating an optimal noise steps selection approach to identify diffusion steps with higher resolution. Extensive experiments on diverse benchmarks demonstrate the superiority of NoiseAD over state-of-the-art methods, further substantiated by insightful visualizations. Code could be available athttps://github.com/shiwang-Xing/NoiseAD.

Recent years have witnessed significant advancements in communication and computing networks, which are increasingly deployed in Internet technology applications. Continuous monitoring and detecting anomalies in key system metrics, most of which are multivariate time series (MTS) data, have become an essential method. Concerning the continuous recording and cyclicality of MTS data in cyber security systems, Energy-Based Models (EBMs) that model unnormalized densities are increasingly favored for their generalization capabilities. Directly learn the data distributions with EBMs is limited by sampler capabilities, leading to a focus on estimating data distribution gradients. However, the gradient of MTS data dynamically changes over time. To address the issue, we propose Anomaly Detection through Learned Temporal Gradient (AnoLTG), a method focused on detecting anomalies in cyber security systems by estimating the temporal gradients of time series. Firstly, we develop a network incorporates noise perturbation for MTS during training, to robustly learns the gradient of current data under historical conditions. Subsequently, MTS are reconstructed through Annealed Langevin Dynamics (ALD), leveraging the learned data gradients for precise anomaly detection. Finally, extensive experiments demonstrate significant performance improvements of AnoLTG over existing state-of-the-art methods.

Multivariate time series anomaly detection, crucial for ensuring the safety of real-world systems, primarily focuses on extracting characteristics from time series under normal condition, and identifying potential anomalies throughout the evaluation process. Recent studies have achieved fruitful progress through mining the spatio-temporal relationships from multivariate time series, however, these approaches mostly neglect the latency among series which could lead to higher false alarm. Granger causality presents a promising solution to extract these inherent time-lagged relationships. Nonetheless, the intricate and dynamic relationships among numerous time series in real-world systems surpass the ability of linear Granger causality. To address this, we extend the linear Granger causality and propose the Granger Causal Former (GCFormer), a novel approach that leverages attention mechanisms to learn the inherent causal spatio-temporal relationships between historical and current timestamps across multiple time series. Specifically, GCFormer develops a Spatio-Mask (SM) to select the top-k most relevant series and a Temporal-Mask (TM) to concentrate attention on more recent historical timestamps. Moreover, to mitigate overfitting and ensure a smooth training process, GCFormer introduces an adjust top-k method and a TM penalty term. We evaluated GCFormer on four real-world benchmark datasets, demonstrating its superior performance over state-of-the-art approaches. Further analysis and a case study highlight the model’s novelty and interpretability.